[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [PATCH] tools/tests: Add EIP check to test_x86_emulator.c


  • To: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, xen-devel@xxxxxxxxxxxxx
  • From: Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>
  • Date: Thu, 07 Aug 2014 12:17:34 +0300
  • Cc: ian.jackson@xxxxxxxxxxxxx, ian.campbell@xxxxxxxxxx, JBeulich@xxxxxxxx, stefano.stabellini@xxxxxxxxxxxxx
  • Comment: DomainKeys? See http://domainkeys.sourceforge.net/
  • Delivery-date: Thu, 07 Aug 2014 09:17:54 +0000
  • Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=bitdefender.com; b=S+mfiGwRAHn+H0Rv+efi9EX67vei7yNe4OXNrkf1kpVX4jwDg95WseKoD7ATxpmfOXMPxhwkiTrvg8IiNc0f4Yl1frixC0b0qfQblK0VhYTjIOhfDIyTpvpsj68L12HS4raoDZkkk8mT8DRSgcoNg+e3cUfK5ZIUiRtAUlm0AyRHF+kjclGd53emZUlJNAwuw3pBve01XH2ZE0fip1lRbpnBaOdg7MPB3WREVFYTeNzbTsba2TzYuBHv//c7EYLVJjbnp6Qowg2nbhCzTbsZWsbFOOdIuD9PZ+d51nj2r2rks5gJs6AnW8lYidhxu7RrO3n4/x04wHkvg1sDGzkoDQ==; h=Received:Received:Received:Received:Message-ID:Date:From:User-Agent:MIME-Version:To:CC:Subject:References:In-Reply-To:Content-Type:Content-Transfer-Encoding:X-BitDefender-Scanner:X-BitDefender-Spam:X-BitDefender-SpamStamp:X-BitDefender-CF-Stamp;
  • List-id: Xen developer discussion <xen-devel.lists.xen.org>

On 08/07/2014 11:18 AM, Andrew Cooper wrote:
> On 07/08/2014 09:16, Razvan Cojocaru wrote:
>> The test now also checks that EIP was modified after emulating
>> instructions after (and including) the "movq %mm3,(%ecx)..."
>> code block.
>>
>> Signed-off-by: Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>
> 
> These checks do check that the instruction pointer has changed, which
> catches your problem, but doesn't check that it has changed correctly. 
> You need to work out exactly how long the instruction is a verify that
> eip points to first byte of the next instruction.

Code like this:

602     printf("%-40s", "Testing movq %mm3,(%ecx)...");
603     if ( stack_exec && cpu_has_mmx )
604     {
605         extern const unsigned char movq_to_mem[];
606
607         asm volatile ( "pcmpeqb %%mm3, %%mm3\n"
608                        ".pushsection .test, \"a\", @progbits\n"
609                        "movq_to_mem: movq %%mm3, (%0)\n"
610                        ".popsection" :: "c" (NULL) );
611
612         memcpy(instr, movq_to_mem, 15);
613         memset(res, 0x33, 64);
614         memset(res + 8, 0xff, 8);
615         regs.eip    = (unsigned long)&instr[0];
616         regs.ecx    = (unsigned long)res;
617         rc = x86_emulate(&ctxt, &emulops);
618         if ( (rc != X86EMUL_OKAY) || memcmp(res, res + 8, 32) ||
619              (regs.eip == (unsigned long)&instr[0]) )
620             goto fail;
621         printf("okay\n");
622     }
623     else
624         printf("skipped\n");

probably shows how useful a generic Xen way of determining instruction
length would be. Where for previous cases it was clear what the length
of the instruction was (since it was being built by assigning each byte
of the instruction buffer explicitly), it's not trivial to determine the
length of a buffer containing a "compiled" instruction and check that
EIP has advanced by the correct ammount.


Thanks,
Razvan Cojocaru

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.